Update PageHook.cpp

Rythorndoran · Dec 4, 2022 · 08cbbf5 · 08cbbf5
1 parent dff5b16
commit 08cbbf5
Showing 1 changed file with 14 additions and 14 deletions.
diff --git a/PageTableHook/PageHook.cpp b/PageTableHook/PageHook.cpp
@@ -72,33 +72,33 @@ namespace PageHook
 
 	auto get_pml4e(std::uint64_t virt) -> pml4e_64*
 	{
-		//PML4E的index*8+PML4E基质
+		//PML4E的index*8+PXE基质
 		auto pml4e_idx = (virt >> 39) & 0x1FF;
 		return reinterpret_cast<pml4e_64*>((pml4e_idx << 3) + pxe_base);
 	}
 
 	auto get_pdpte(std::uint64_t virt) -> pdpte_64*
 	{
-		//PDPTE的index*8+PDPTE基质
+		//PDPTE的index*8+PPE基质
 		auto pdpte_idx = (virt >> 30) & 0x3FFFF;
 		return reinterpret_cast<pdpte_64*>((pdpte_idx << 3) + ppe_base);
 	}
 
 	auto get_pde(std::uint64_t virt) -> pde_64*
 	{
-		//PDE的index*8+PDPTE基质
+		//PDE的index*8+PDE基质
 		auto pde_idx = (virt >> 21) & 0x7FFFFFF;
 		return reinterpret_cast<pde_64*>((pde_idx << 3) + pde_base);
 	}
 
 	auto get_pte(std::uint64_t virt) -> pte_64*
 	{
-		//PTE的index*8+PDPTE基质
+		//PTE的index*8+PTE基质
 		auto pte_idx = (virt >> 21) & 0xFFFFFFFFF;
 		return reinterpret_cast<pte_64*>((pte_idx << 3) + pte_base);
 	}
 
-	//大页拆分小页
+	//大页拆分小页
 	auto split_large_page(pde_64* large_page) -> std::tuple<pt_entry_64*, uint64_t>
 	{
 		if (!large_page->large_page)
@@ -154,7 +154,7 @@ namespace PageHook
 	}
 
 	/// <summary>
-	/// 记得切换到目标进程的地址空间后再进行page hook
+	/// 记得切换到目标进程的地址空间后再进行page hook
 	/// </summary>
 	/// <param name="target function pointer"></param>
 	/// <param name="hook function pointer"></param>
@@ -164,7 +164,7 @@ namespace PageHook
 	{
 		init_pte_base();
 
-		//获取pxe
+		//获取pxe
 		auto pml4e = get_pml4e(reinterpret_cast<std::uint64_t>(target_function));
 		auto pdpte = get_pdpte(reinterpret_cast<std::uint64_t>(target_function));
 		auto pde = get_pde(reinterpret_cast<std::uint64_t>(target_function));
@@ -180,7 +180,7 @@ namespace PageHook
 		if (pde->present && !pde->large_page)
 			pt = (pt_entry_64*)pfn_to_virt(pde->page_frame_number);
 
-		//从pml4e开始构造页表
+		//从pml4e开始构造页表
 		auto [new_pdpt_pfn, new_pdpt_virt] = create_pagetable();
 		copy_pagetable(new_pdpt_virt, pdpt);
 
@@ -192,23 +192,23 @@ namespace PageHook
 
 		auto [hook_page_pfn, hook_page_virt] = copy_page(page_align(reinterpret_cast<std::uint64_t>(target_function)));
 
-		//定位足够长的代码来写jmp code
+		//定位足够长的代码来写jmp code
 		size_t code_len = 0;
 		hde64s hde64_code;
 		while (code_len < 14) {
 			HdeDisassemble(((uint8_t*)target_function + code_len), &hde64_code);
 			code_len += hde64_code.len;
 		}
 
-		//生成trampline函数
+		//生成trampline函数
 		auto trampline = new unsigned char[0x100];
 		ULARGE_INTEGER jmp_to_back = { .QuadPart = (uint64_t)(target_function)+code_len };
 		RtlCopyMemory(trampline, target_function, code_len);
 		RtlCopyMemory(&trampline[code_len], jmp_code, sizeof(jmp_code));
 		RtlCopyMemory(&trampline[code_len + 1], &jmp_to_back.LowPart, sizeof(uint32_t));
 		RtlCopyMemory(&trampline[code_len + 9], &jmp_to_back.HighPart, sizeof(uint32_t));
 
-		//在新的页面上hook
+		//在新的页面上hook
 		uint64_t page_offset = (uint64_t)(target_function) & 0xFFF;
 		uint8_t* hook_page = reinterpret_cast<uint8_t*>(hook_page_virt);
 		ULARGE_INTEGER jmp_to_detour = { .QuadPart = (uint64_t)(hook_function) };
@@ -219,17 +219,17 @@ namespace PageHook
 
 		virt_helper helper = { .all = reinterpret_cast<std::uint64_t>(target_function) };
 
-		//将新的页面链接起来
+		//将新的页面链接起来
 		new_pdpt_virt[helper.index.pdpte].page_frame_number = new_pd_pfn;
 		new_pd_virt[helper.index.pde].page_frame_number = new_pt_pfn;
 		new_pd_virt[helper.index.pde].large_page = 0;
 		new_pt_virt[helper.index.pte].page_frame_number = hook_page_pfn;
 
-		//最后一步,修改pml4e
+		//最后一步,修改pml4e
 		pml4e->page_frame_number = new_pdpt_pfn;
 
 		__invlpg(pml4e);
 
 		*original_function = trampline;
 	}
-}
+}